CVE-2023-3527

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software

such as Microsoft Excel.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

VendorProductVersions
AvayaAvaya Call Management System19.x.x.x

References

Timeline

Published
Jul 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-35289.8A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2023-35297.5A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the filCVE-2023-352966.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-352978.1Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityCVE-2023-352987.5HTTP.sys Denial of Service VulnerabilityCVE-2023-352997.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2023-353008.8Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2023-353028.8Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-353038.8USB Audio Class System Driver Remote Code Execution VulnerabilityCVE-2023-353047.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-353057.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-353065.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
CVE-2023-3527: Medium severity, CVSS 6.8 | Vulnix